Explore how we help HSL integrate security into software development from the start through a hands-on Security Champions model.
Introducing the Security Champions model
When the collaboration started, the goal was to improve visibility into the security of HSL’s software and make good security practices a natural part of the development process. We wanted to help teams identify and address security considerations throughout development, rather than relying mainly on assessments at the end of a project.
A central part of the approach is the Security Champions model. Each software development team has a designated Security Champion who dedicates part of their working time to security-related activities. The champions receive guidance, training, and support, helping them bring knowledge directly to their teams.
Our work goes beyond writing guidelines. We help put them into practice, support the adoption of security tools, and keep the guidance up to date as new technologies and requirements emerge. We work alongside Developers to help them understand and address security issues, rather than leaving them to solve reported problems on their own.
The collaboration also creates a two-way channel for communication. The Security Champions can raise questions and share challenges from their teams, while we can identify recurring themes across different development teams and bring them to the attention of HSL’s security specialists. This connects practical development work with broader security priorities.
Making security a shared responsibility
The Security Champions model is built around regular interaction and continuous learning. The group meets weekly to discuss security topics, explore tools, and share knowledge. We also provide guidance when new champions join or when development teams need support with a particular security challenge.
By working and talking directly with Developers, we avoid the broken telephone effect, where a message passes through several people and changes along the way before reaching the person who needs to act on it.
We work with a range of stakeholders at HSL, including security specialists, product owners, developers, and platform teams. Depending on the topic, the collaboration may also involve architecture groups and other specialists.
This requires both technical expertise and an understanding of how software development works in practice. Security recommendations need to fit the teams’ workflows and address the right problems without creating unnecessary friction. We need to understand the circumstances in which Developers work and help them improve, rather than just pointing out shortcomings.
Our starting point is that people are doing their best with the information and tools they have. We’re there to help them move forward, build trust, and make it easier to ask questions when they need support.
From a pilot to a wider community
The collaboration began with a pilot involving a handful of development teams. They tested the working methods and tools, allowing us to refine the approach before expanding further. Since then, the model has grown to involve around 15 teams, including those working with data platforms and people from external partners. It has become a more established part of how security is supported across HSL’s development environment.
The expansion reflects the value of building practical ways of working that teams can adopt and continue using themselves. We aim to give development teams the knowledge, tools, and support they need to manage security throughout the software development lifecycle, while knowing where to turn when they need help.
We also maintain and develop security guidelines as requirements change. A document written a few years ago cannot cover every new technology or emerging threat, so the guidance needs to evolve alongside the work.
Regular training helps keep security visible, while the Security Champions provide a practical link between shared guidelines and the everyday decisions made by development teams.
Staying ahead of emerging AI-related security threats
One area that has required particular attention is the growing use of AI. AI tools can help developers work more efficiently, but they also raise questions about how to use them securely. We research emerging risks, evaluate relevant approaches, and develop guidance to help teams make informed decisions.
We also explore new approaches to security testing. One example is AI-driven security testing, where AI agents are used in a controlled environment to test systems for potential weaknesses. This allows us to explore emerging technology while keeping the testing within defined boundaries.
Alongside these developments, we work on software component inventories and Software-Bill-of-Materials (SBOM). Modern applications are built using a combination of code, libraries, frameworks, and other components. Vulnerabilities in these underlying dependencies can introduce security risks. Having an up-to-date inventory makes it easier to determine which applications may be affected by a newly identified vulnerability and where further investigation is needed.
Building security into the software lifecycle
Security cannot be assessed once and then considered complete. Software changes continuously, and new vulnerabilities can be discovered in existing components even when an application itself hasn’t changed. This is why we focus on making security checks a continuous part of software development. By using appropriate tools and establishing consistent practices, development teams can identify and address issues throughout the process, with security checks forming part of their regular work rather than being left until just before release.
Introducing security tools and practices can take time, particularly when teams are adopting them for the first time. Initial scans may produce many findings that need to be reviewed, prioritised, and addressed. We help developers understand these results and establish workflows that make security checks a sustainable part of their work.
For HSL, the result is a more structured foundation for managing software security, with development teams better equipped to apply agreed practices independently and seek support when needed.
Learning and collaborating
Working with HSL has also provided opportunities for us to develop our own expertise. The rapid evolution of AI and security tooling means there is always something new to investigate, test, and learn.
